An operations team manages Linux servers over SSH. The security team wants to stop direct management access from employee laptops, reduce lateral movement if one admin endpoint is compromised, and keep a log of every administrative session. Which two design choices best fit? Select two.

Let all corporate laptops connect directly to SSH on the servers if MFA is enabled.

MFA is useful, but direct access from every corporate laptop still expands the attack surface and makes lateral movement much easier after an endpoint compromise. The scenario explicitly asks to stop direct management access and reduce spread, so a central jump path is better than broad direct reachability.

Expose SSH to the internet because key-based authentication is already strong.

Publicly exposing SSH is unnecessary and increases brute-force, scanning, and exploitation risk. Key-based authentication helps, but it does not justify direct internet access to management services. The requirement is to remove direct access from employee laptops, not extend management services to untrusted networks.

Use split tunneling for admin traffic so management packets can bypass the VPN.

Split tunneling is generally used to route some traffic outside the secure tunnel, which is the opposite of what this scenario needs. Management traffic should be tightly controlled and inspected, not routed around security controls. Bypassing the VPN would weaken the protected management path.

What does this SY0-701 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Require administrators to connect to a bastion host or jump server before reaching the Linux servers. — The best architecture uses a bastion host as the only entry point for administration and limits the managed servers so only that host can reach their management interfaces. This design sharply reduces direct exposure, creates a centralized audit trail, and helps contain compromise if an admin workstation is attacked. It is a secure, practical way to support SSH administration. Why others are wrong: Direct SSH from all corporate laptops leaves the servers reachable from many endpoints and increases lateral movement risk. Exposing SSH to the internet is even worse because it broadens the attack surface unnecessarily. Split tunneling would allow management traffic to avoid the controlled path, undermining the central logging and access restrictions the scenario requires.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.